#! /bin/bash
# Author:gaoshan(Nahsoagoac) 
# iptables open port
# iptables 防火墙开启端口

# v1.1 修复在TCP和UDP下出现相同端口无法正常覆盖已有规则的情况
# v1.2 新增centos端口范围调整
# v1.3 新增删除端口放行功能
# v1.4 新增ubuntu ufw放行端口范围支持
# v1.5 调整了初始显示已放行的端口规则
# v1.6 新增了对centos7以上的firewalld的支持，避免切换防火墙导致规则出现问题

NewPort=""
NewPortRange=""
FLITERTYPE=""

if [ ! -f /etc/redhat-release ]; then
	OS='ubuntu'
else
	CENTOS_VER=$(rpm -q centos-release|cut -d- -f3)
	if [ "$CENTOS_VER" = "6" ]; then
		OS='centos6'
	else
		OS='centos7'
	fi
fi

msgbox()
{
	case $1 in
		text ) color="\e[34;1m"
		;;
		alert ) color="\e[31;1m"
		;;
		result ) color="\e[33;1m"
		;;
		jump ) color="\e[35;1m"
		;;
		pam ) color="\e[32;1m"
		;;
		normal ) color="\e[37;1m"
	esac
	echo -e "${color}${2}\e[0m\c"
}

num_check() 
{
	num=${1}
	expr $num + 0 &>/dev/null #整数
	k=$?
	while [ $k -ne 0 ] || [ $num -lt 1 ] || [ $num -gt 65534 ]; do
		msgbox "alert" "端口$num不正确，请重新输入(大于1小于65535的正整数)："
		read -p "" num;
		expr $num + 0 &>/dev/null
		k=$?
	done
	NewPort=$num
}

yn_check()
{
	parameter=${1}
	while [ "$parameter" != 'y' ] && [ "$parameter" != 'n' ]; do
		msgbox "alert" "输入有误,请输入y或者n[y/n]:"
		read -p "" parameter;
	done
	case $parameter in
		y) n=1
		;;
		n) n=0
		;;
	esac
	return $n;
}

firewall_open()
{
	protcal=${2}
	if [[ "$protcal" = "1" ]]; then
		protcal="tcp"
	else
		protcal="udp"
	fi
	i=$(firewall-cmd --zone=public --list-ports | grep -w "${1}/$protcal" | wc -l)
	if [[ $i -gt 0 ]]; then
		firewall-cmd --zone=public --list-ports | grep -w "${1}/$protcal"
		msgbox "alert" "检测到存在入站端口规则!是否覆盖操作？[y/n]:"
		read -p "" ow
		yn_check "$ow"
		ow=$?
		if [[ "$ow" = "1" ]]; then
			ow_firewall_rule "${1}" "$protcal"
			msgbox "result" "端口${1}/协议$protcal，放行配置已生效";echo
		else
			msgbox "jump" "已跳过该协议$protcal端口${1}设置";echo
		fi
	else
		firewall-cmd --zone=public --add-port=${1}/$protcal --permanent
		firewall-cmd --reload
		msgbox "result" "端口${1}/协议$protcal，放行配置已生效";echo
	fi
}

ow_firewall_rule()
{
	firewall-cmd --zone=public --remove-port=${1}/$protcal --permanent
	firewall-cmd --zone=public --add-port=${1}/$protcal --permanent
	firewall-cmd --reload
}

port_new()
{
	protcal=${2}
	if [[ "$protcal" = "1" ]]; then
		protcal="tcp"
	else
		protcal="udp"
	fi
	i=$(iptables -nvL INPUT --line | grep -w "$protcal dpt:${1}" | wc -l)
	#j=$(iptables -nvL OUTPUT --line | grep -w "$protcal dpt:${1}" | wc -l)
	if [[ $i -gt 0 ]]; then
		iptables -nvL INPUT --line | grep -w "$protcal dpt:${1}"
		msgbox "alert" "检测到存在入站端口规则!是否覆盖操作？[y/n]:"
		read -p "" ow
		yn_check "$ow"
		ow=$?
		if [[ "$ow" = "1" ]]; then
			overwrite "$i" "${1}" "$protcal"
			iptables -I INPUT -p $protcal -m $protcal --dport ${1} -j ACCEPT
			msgbox "alert" "如下规则即将写入"
			for (( i = 0; i < 5; i++ )); do
				sleep 0.3
				msgbox "alert" "."
			done
			echo
			iptables -nvL INPUT --line
			iptables-save > /etc/sysconfig/iptables
			service iptables restart
			msgbox "result" "端口${1}/协议$protcal，放行配置已生效";echo
		else
			msgbox "jump" "已跳过该协议$protcal端口${1}设置";echo
		fi
	else
		iptables -I INPUT -p $protcal -m $protcal --dport ${1} -j ACCEPT
		msgbox "alert" "如下规则即将写入"
		for (( i = 0; i < 5; i++ )); do
			sleep 0.3
			msgbox "alert" "."
		done
		echo
		iptables -nvL INPUT --line
		iptables-save > /etc/sysconfig/iptables
		service iptables restart
		msgbox "result" "端口${1}/协议$protcal，放行配置已生效";echo
	fi
	
}

overwrite()
{
	k=${1}
	protcal=${3}
	for (( i = 0; i < k; i++ )); do
		firstportnum=$(iptables -nvL INPUT --line | grep -w "${3} dpt:${2}" | awk 'NR==1{print}' |awk '{print $1}')
		iptables -D INPUT $firstportnum
	done
}

overwrite_range()
{
	k=${1}
	protcal=${3}
	for (( i = 0; i < k; i++ )); do
		firstportnum=$(iptables -nvL INPUT --line | grep -w "${3} dpts:${2}" | awk 'NR==1{print}' |awk '{print $1}')
		iptables -D INPUT $firstportnum
	done
}

tcp_udp()
{
	i=${1}
	while [ "$i" != "" ]&&[ "$i" != "udp" ]; do
		msgbox "alert" "输入有误，请重新输入端口协议(tcp直接回车,udp端口请单独输入)" 
		read -p "" i
	done
	if [[ "$i" = "" ]]; then
		i=1
	else
		i=0
	fi
	return $i
}

range()
{
	protcal=${2}
	if [[ "$protcal" = "1" ]]; then
		protcal="tcp"
	else
		protcal="udp"
	fi
	i=$(iptables -nvL INPUT --line | grep -w "$protcal dpts:${1}" | wc -l)
	if [[ $i -gt 0 ]]; then
		iptables -nvL INPUT --line | grep -w "$protcal dpts:${1}"
		msgbox "alert" "检测到存在入站端口范围规则!是否覆盖操作？[y/n]:"
		read -p "" ow
		yn_check "$ow"
		ow=$?
		if [[ "$ow" = "1" ]]; then
			overwrite_range "$i" "${1}" "$protcal"
			iptables -I INPUT -p $protcal -m $protcal --dport ${1} -j ACCEPT
			msgbox "alert" "如下规则即将写入"
			for (( i = 0; i < 5; i++ )); do
				sleep 0.3
				msgbox "alert" "."
			done
			echo
			iptables -nvL INPUT --line
			iptables-save > /etc/sysconfig/iptables
			service iptables restart
			msgbox "result" "端口范围${1}/协议$protcal，放行配置已生效";echo
			else
			msgbox "jump" "已跳过该协议$protcal端口范围${1}设置";echo
		fi
	else
			iptables -I INPUT -p $protcal -m $protcal --dport ${1} -j ACCEPT
			msgbox "alert" "如下规则即将写入"
			for (( i = 0; i < 5; i++ )); do
				sleep 0.3
				msgbox "alert" "."
			done
			echo
			iptables -nvL INPUT --line
			iptables-save > /etc/sysconfig/iptables
			service iptables restart
			msgbox "result" "端口范围${1}/协议$protcal，放行配置已生效";echo
	fi
}

range_check()
{
	prange=${1}
	range_to_port "$prange"
	while [[ $PORT1 -gt $PORT2 ]]; do
		msgbox "alert" "后面的端口需要大于前面的端口,请重新输入端口范围(例如730:820):";
		read -p "" prange
		range_to_port "$prange"
	done
	if [[ "$FLITERTYPE" = "firewalld" ]]; then
		NewPortRange="$PORT1-$PORT2"
	else
		NewPortRange="$PORT1:$PORT2"
	fi
}

range_to_port() #将范围端口转换为两个数字进行合法性判断
{
	portrange=${1}
	OLD_IFS="$IFS"
	IFS=":"
	portranges=($portrange)
	IFS="$OLD_IFS"
	#echo ${portranges[0]}
	#echo ${portranges[1]}
	num_check "${portranges[0]}"
	PORT1=$NewPort
	num_check "${portranges[1]}"
	PORT2=$NewPort
}

centos()
{
	continue=1
	while [[ "$continue" = "1" ]]; do
		auto_check
		msgbox "text" "请输入需要开放的端口(注:范围端口请输入";msgbox "alert" "端口1:端口2";msgbox "text" ",如";msgbox "alert" "730:820";msgbox "text" "):"; 
		read -p "" newport
		if [[ $newport =~ ":" ]]; then
			range_check "$newport"
			msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
			read -p "" tcporudp
			tcp_udp "$tcporudp"
			tcporudp=$?
			if [[ "$FLITERTYPE" = "firewalld" ]]; then
				firewall_open "$NewPortRange" "$tcporudp"
			else
				range "$NewPortRange" "$tcporudp"
			fi
		else
			num_check "$newport"
			msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
			read -p "" tcporudp
			tcp_udp "$tcporudp"
			tcporudp=$?
			if [[ "$FLITERTYPE" = "firewalld" ]]; then
				firewall_open "$NewPort" "$tcporudp"
			else
				port_new "$NewPort" "$tcporudp"
			fi
		fi
		msgbox "normal" "是否还需继续开放端口?[y/n]:"
		read -p "" continue
		yn_check "$continue"
		continue=$?
	done
}

auto_check()
{
	if [[ "$OS" != "ubuntu" ]]; then
		if [[ "$OS" = "centos7" ]]; then
			firewallstate=$(systemctl status firewalld.service | grep "inactive" | wc -l)
			if [[ "$firewallstate" = "0" ]]; then
				OpenPort=($(firewall-cmd --list-ports))
				msgbox "text" "检测到为centos7及以上系统，运行firewall防火墙，"
				FLITERTYPE="firewalld"
			else #centos7使用iptables情况
				isinstall=$(rpm -qa | grep iptables | wc -l)
				if [[ "$isinstall" = "0" ]]; then
					msgbox "alert" "检测到未安装防火墙服务，默认不会有拦截，是否安装iptables?[y/n]:"
					read -p "" installiptb
					yn_check "$installiptb"
					installiptb=$?
					if [[ "$installiptb" = "1" ]]; then
						yum install iptables -y
						msgbox "text" "已安装iptables服务";echo
						OpenPort=($(iptables -nvL INPUT --line | awk '{print $NF}'| grep dpt | awk -F ":" '{if(!$3) print$2;else print$2":"$3}'))
						FLITERTYPE="iptables"
					else
						msgbox "未安装防火墙服务，无端口拦截限制，退出";echo
						exit
					fi
				else
					iptabstate=$(systemctl status iptables | grep -w "inactive" | wc -l)
					if [[ "$iptabstate" = "1" ]]; then
						msgbox "alert" "检测到iptables未启动，不会有端口拦截，是否启动？[y/n]:"
						read -p "" startiptable
						yn_check "$startiptable"
						startiptable=$?
						if [[ "$startiptable" = "1" ]]; then
							systemctl start iptables
							OpenPort=($(iptables -nvL INPUT --line | awk '{print $NF}'| grep dpt | awk -F ":" '{if(!$3) print$2;else print$2":"$3}'))
							msgbox "text" "检测到为centos7及以上系统，运行iptables防火墙，"
							FLITERTYPE="iptables"
						else
							msgbox "text" "无端口拦截限制，退出";echo
							exit
						fi
					else
						OpenPort=($(iptables -nvL INPUT --line | awk '{print $NF}'| grep dpt | awk -F ":" '{if(!$3) print$2;else print$2":"$3}'))
						msgbox "text" "检测到为centos7及以上系统，运行iptables防火墙，"
						FLITERTYPE="iptables"
					fi
				fi	
			fi
		else #centos6 iptables检测,经测试iptables无法卸载的，默认centos有安装
			iptabstate=$(service iptables status | grep "Firewall is not running" | wc -l)
			if [[ "$iptabstate" = "1" ]]; then
				msgbox "alert" "检测到iptables未启动，不会有端口拦截，是否启动？[y/n]:"
				read -p "" startiptable
				yn_check "$startiptable"
				startiptable=$?
				if [[ "$startiptable" = "1" ]]; then
					service iptables start
				else
					msgbox "text" "无端口拦截限制，退出";echo
					exit
				fi
			fi
			OpenPort=($(iptables -nvL INPUT --line | awk '{print $NF}'| grep dpt | awk -F ":" '{if(!$3) print$2;else print$2":"$3}'))
			msgbox "text" "检测到为centos6及以下系统，运行iptables防火墙，"
		fi
		if [[ ${#OpenPort[*]} -eq 0 ]]; then
			msgbox "alert" "未检测到端口放行";echo
		else
			msgbox "text" "当前已放行的端口或端口段如下:";echo
			msgbox "normal" "["
			for (( OpenPortnum = 0; OpenPortnum < ${#OpenPort[*]}; OpenPortnum++ )); do
				msgbox "result" "${OpenPort[$OpenPortnum]}"
				if [[ $OpenPortnum -ne $(expr ${#OpenPort[*]} - 1 ) ]]; then
					msgbox "normal" "|"
				fi
			done
			msgbox "normal" "]";echo
		fi
	else
		ufw status numbered
	fi
}


ubuntu()
{
	check_ufw
	ufwstatus=$?
	if [[ "$ufwstatus" = "1" ]]; then
		msgbox "text" "当前端口规则如下:";echo
		auto_check
		ubuntu_port
	else
		msgbox "alert" "检测到ufw防火墙未运行，默认不会拦截端口，是否需要开启防火墙并且设置端口？[y/n]："
		read -p "" ub
		yn_check "$ub"
		ub=$?
		if [[ "$ub" = "1" ]]; then
			ufw enable << EOF
y
EOF
			ubuntu_port
		else
			msgbox "jump" "跳过端口设置";echo
		fi
	fi
	
}

check_ufw()
{
	i=$(ufw status | grep -w "active" | wc -l)
	if [[ $i -ne 0 ]]; then
		i=1
	else
		i=0
	fi
	return $i
}

ubuntu_port()
{
	continue=1
	while [[ "$continue" = "1" ]]; do
		msgbox "text" "请输入需要开放的端口(注:范围端口请输入";msgbox "alert" "端口1:端口2";msgbox "text" ",如";msgbox "alert" "730:820";msgbox "text" "):"; 
		read -p "" newport
		if [[ $newport =~ ":" ]]; then
			range_check "$newport"
			msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
			read -p "" tcporudp
			tcp_udp "$tcporudp"
			tcporudp=$?
			ufw_range_new "$NewPortRange" "$tcporudp"
		else
			num_check "$newport"
			msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
			read -p "" tcporudp
			tcp_udp "$tcporudp"
			tcporudp=$?
			ufw_new "$NewPort" "$tcporudp"
		fi
		msgbox "normal" "是否还需继续开放端口?[y/n]:"
		read -p "" continue
		yn_check "$continue"
		continue=$?
	done
}

ufw_range_new()
{
	protcal=${2}
	if [[ "$protcal" = "1" ]]; then
		protcal="tcp"
	else
		protcal="udp"
	fi
	sshport=$(cat /etc/ssh/sshd_config | grep -w "Port" | awk '{print$NF}')
	ufw allow $sshport/tcp
	isport=$(ufw status | grep -w "${1}/$protcal" | wc -l)
	if [[  $isport -gt 0  ]]; then
		ufw status | grep -w "${1}/$protcal" 
		msgbox "alert" "检测到存在该端口范围规则!是否覆盖操作？[y/n]:"
		read -p "" ow
		yn_check "$ow"
		ow=$?
		if [[ "$ow" = "1" ]]; then
			overwriteufw "${1}" "$protcal"
			msgbox "result" "已经添加端口范围${1}/$protcal规则";echo
			ufw status | grep -w "${1}/$protcal"
		else
			msgbox "jump" "跳过该端口范围设置";echo
		fi
	else
		ufw default deny
		ufw allow ${1}/$protcal
		ufw reload
		msgbox "result" "已经添加端口范围${1}/$protcal规则";echo
		ufw status | grep -w "${1}/$protcal"
	fi
}

ufw_new()
{
	protcal=${2}
	if [[ "$protcal" = "1" ]]; then
		protcal="tcp"
	else
		protcal="udp"
	fi
	sshport=$(cat /etc/ssh/sshd_config | grep -w "Port" | awk '{print$NF}')
	ufw allow $sshport/tcp
	isport=$(ufw status | grep -w "${1}/$protcal" | wc -l)
	if [[  $isport -gt 0  ]]; then
		ufw status | grep -w "${1}/$protcal" 
		msgbox "alert" "检测到存在该端口规则!是否覆盖操作？[y/n]:"
		read -p "" ow
		yn_check "$ow"
		ow=$?
		if [[ "$ow" = "1" ]]; then
			overwriteufw "${1}" "$protcal"
			msgbox "result" "已经添加端口${1}/$protcal规则";echo
			ufw status | grep -w "${1}/$protcal"
		else
			msgbox "jump" "跳过该端口设置";echo
		fi
	else
		ufw default deny
		ufw allow ${1}/$protcal
		ufw reload
		msgbox "result" "已经添加端口${1}/$protcal规则";echo
		ufw status | grep -w "${1}/$protcal"
	fi
}

overwriteufw()
{
	ufw default deny
	ufw delete allow ${1}/${2} << EOF
y
EOF
	ufw allow ${1}/${2}
	ufw reload
}

del_firewall_port()
{
	continue=1
	while [[ "$continue" = "1" ]]; do
		#msgbox "result" "当前规则如下";echo
		#firewall-cmd --zone=public --list-ports
		msgbox "text" "请输入需要关闭的端口(注:范围端口请输入";msgbox "alert" "端口1:端口2";msgbox "text" ",如";msgbox "alert" "730:820";msgbox "text" "):"; 
		read -p "" newport
		if [[ $newport =~ ":" ]]; then
			range_check "$newport"
			msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
			read -p "" tcporudp
			tcp_udp "$tcporudp"
			tcporudp=$?
			if [[ "$tcporudp" = "1" ]]; then
				protcal="tcp"
			else
				protcal="udp"
			fi
			i=$(firewall-cmd --zone=public --list-ports | grep -w "$NewPortRange/$protcal" | wc -l)
			while [[ $i -eq 0 ]]; do
				msgbox "alert" "未找到该范围规则，请重新输入："
				read -p "" newport
				range_check "$newport"
				msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
				read -p "" tcporudp
				tcp_udp "$tcporudp"
				tcporudp=$?
				if [[ "$tcporudp" = "1" ]]; then
					protcal="tcp"
				else
					protcal="udp"
				fi
				i=$(firewall-cmd --zone=public --list-ports | grep -w "$NewPortRange/$protcal" | wc -l)
			done
			firewall-cmd --zone=public --remove-port=$NewPortRange/$protcal --permanent
			firewall-cmd --reload
			msgbox "result" "端口范围$NewPortRange/$protcal相关配置已删除放行";echo
		else
			num_check "$newport"
			msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
			read -p "" tcporudp
			tcp_udp "$tcporudp"
			tcporudp=$?
			if [[ "$tcporudp" = "1" ]]; then
				protcal="tcp"
			else
				protcal="udp"
			fi
			i=$(firewall-cmd --zone=public --list-ports | grep -w "$NewPort/$protcal" | wc -l)
			while [[ $i -eq 0 ]]; do
				msgbox "alert" "未找到该范围规则，请重新输入："
				read -p "" newport
				range_check "$newport"
				msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
				read -p "" tcporudp
				tcp_udp "$tcporudp"
				tcporudp=$?
				if [[ "$tcporudp" = "1" ]]; then
					protcal="tcp"
				else
					protcal="udp"
				fi
				i=$(firewall-cmd --zone=public --list-ports | grep -w "$NewPort/$protcal" | wc -l)
			done
			firewall-cmd --zone=public --remove-port=$NewPort/$protcal --permanent
			firewall-cmd --reload
			msgbox "result" "端口$NewPort/$protcal相关配置已删除放行";echo
		fi
		msgbox "normal" "是否还需继续关闭端口?[y/n]:"
		read -p "" continue
		yn_check "$continue"
		continue=$?
		if [[ "$continue" = "1" ]]; then
			auto_check
		fi
	done
}

del_centos_port()
{
	auto_check
	if [[ "$FLITERTYPE" = "firewalld" ]]; then
		del_firewall_port
	else
		continue=1
		while [[ "$continue" = "1" ]]; do
			#msgbox "result" "当前规则如下";echo
			#cat /etc/sysconfig/iptables
			msgbox "text" "请输入需要关闭的端口(注:范围端口请输入";msgbox "alert" "端口1:端口2";msgbox "text" ",如";msgbox "alert" "730:820";msgbox "text" "):"; 
			read -p "" newport
			if [[ $newport =~ ":" ]]; then
				#echo "1" 调试用
				range_check "$newport"
				msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
				read -p "" tcporudp
				tcp_udp "$tcporudp"
				tcporudp=$?
				if [[ "$tcporudp" = "1" ]]; then
					protcal="tcp"
				else
					protcal="udp"
				fi
				i=$(iptables -nvL INPUT --line | grep -w "$protcal dpts:$NewPortRange" | wc -l)
				while [[ $i -eq 0 ]]; do
					msgbox "alert" "未找到该范围规则，请重新输入："
					read -p "" newport
					range_check "$newport"
					msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
					read -p "" tcporudp
					tcp_udp "$tcporudp"
					tcporudp=$?
					if [[ "$tcporudp" = "1" ]]; then
						protcal="tcp"
					else
						protcal="udp"
					fi
					i=$(iptables -nvL INPUT --line | grep -w "$protcal dpts:$NewPortRange" | wc -l)
				done
				overwrite_range "$i" "$NewPortRange" "$protcal"
				iptables -nvL INPUT --line
				iptables-save > /etc/sysconfig/iptables
				service iptables restart
				msgbox "result" "端口范围$NewPortRange/$protcal相关配置已删除放行";echo
			else
				#echo $newport 调试用
				num_check "$newport"
				msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
				read -p "" tcporudp
				tcp_udp "$tcporudp"
				tcporudp=$?
				if [[ "$tcporudp" = "1" ]]; then
					protcal="tcp"
				else
					protcal="udp"
				fi
				i=$(iptables -nvL INPUT --line | grep -w "$protcal dpt:$NewPort" | wc -l)
				while [[ $i -eq 0 ]]; do
					msgbox "alert" "未找到该端口规则，请重新输入："
					read -p "" newport
					num_check "$newport"
					msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
					read -p "" tcporudp
					tcp_udp "$tcporudp"
					tcporudp=$?
					if [[ "$tcporudp" = "1" ]]; then
						protcal="tcp"
					else
						protcal="udp"
					fi
					i=$(iptables -nvL INPUT --line | grep -w "$protcal dpt:$NewPort" | wc -l)
				done
				overwrite "$i" "$NewPort" "$protcal"
				iptables -nvL INPUT --line
				iptables-save > /etc/sysconfig/iptables
				service iptables restart
				msgbox "result" "端口$NewPort/$protcal相关配置已删除放行";echo
			fi
			msgbox "normal" "是否还需继续关闭端口?[y/n]:"
			read -p "" continue
			yn_check "$continue"
			continue=$?
			if [[ "$continue" = "1" ]]; then
			auto_check
			fi
		done
	fi
}

del_ubuntu_port()
{
	continue=1
	while [[ "$continue" = "1" ]]; do
		msgbox "result" "当前规则如下";echo
		ufw status numbered
		msgbox "text" "请输入需要关闭的端口(注:范围端口请输入";msgbox "alert" "端口1:端口2";msgbox "text" ",如";msgbox "alert" "730:820";msgbox "text" "):";
		read -p "" del_port
		if [[ $del_port =~ ":" ]]; then
			range_check "$del_port"
			msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
			read -p "" tcporudp
			tcp_udp "$tcporudp"
			tcporudp=$?
			if [[ "$tcporudp" = "1" ]]; then
				protcal="tcp"
			else
				protcal="udp"
			fi
			i=$(ufw status | grep -w "$NewPortRange/$protcal" | wc -l)
			while [[ $i -eq 0  ]]; do
				msgbox "alert" "未找到该范围规则，请重新输入："
				read -p "" del_port
				range_check "$del_port"
				msgbox "text" "请输入端口范围协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
				read -p "" tcporudp
				tcp_udp "$tcporudp"
				tcporudp=$?
				if [[ "$tcporudp" = "1" ]]; then
					protcal="tcp"
				else
					protcal="udp"
				fi
				i=$(ufw status | grep -w "$NewPortRange/$protcal" | wc -l)
			done
			ufw default deny
			ufw delete allow $NewPortRange/$protcal << EOF
y
EOF
			ufw reload
			msgbox "result" "端口段$NewPortRange/$protcal相关配置已删除放行";echo
		else
			num_check "$del_port"
			msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
			read -p "" tcporudp
			tcp_udp "$tcporudp"
			tcporudp=$?
			if [[ "$tcporudp" = "1" ]]; then
				protcal="tcp"
			else
				protcal="udp"
			fi
			i=$(ufw status | grep -w "$NewPort/$protcal" | wc -l)
			while [[ i -eq 0 ]]; do
				msgbox "alert" "未找到该端口规则，请重新输入："
				read -p "" del_port
				num_check "$del_port"
				msgbox "text" "请输入端口协议类型，默认为tcp（网站，数据库，远程等均为tcp端口）";msgbox "alert" "回车";msgbox "text" "即可，如果是udp端口请输入udp:"
				read -p "" tcporudp
				tcp_udp "$tcporudp"
				tcporudp=$?
				if [[ "$tcporudp" = "1" ]]; then
					protcal="tcp"
				else
					protcal="udp"
				fi
				i=$(ufw status | grep -w "$NewPort/$protcal" | wc -l)
			done
			ufw default deny
			ufw delete allow $NewPort/$protcal << EOF
y
EOF
			ufw reload
			msgbox "result" "端口$NewPort/$protcal相关配置已删除放行";echo
		fi
		msgbox "normal" "是否还需继续关闭端口?[y/n]:"
		read -p "" continue
		yn_check "$continue"
		continue=$?
	done
}

check1_2()
{
	num=${1}
	while [ "$num" != "1" ]&&[ "$num" != "2" ]; do
		msgbox "alert" "输入有误，请输入，1或2:"
		read -p "" choose
		num=$choose
	done
	return $num
}

#main part
msgbox "text" "  ┌=========================================================┐";echo
msgbox "normal" "   欢迎使用iptables/ufw端口调整工具。检测到当前系统是";msgbox "alert" "$OS";echo
msgbox "text" "                                                            ";echo
msgbox "text" "                ";msgbox "pam" "1、放行端口      2、删除端口放行            ";echo
msgbox "text" "  └=========================================================┘";echo
msgbox "normal" "请输入，1或2:"
read -p "" choose
check1_2 "$choose"
choose=$?
if [[ "$choose" = "1" ]]; then
	if [[ $OS != 'ubuntu' ]]; then
		centos
	else
		ubuntu
	fi
else
	if [[ $OS != 'ubuntu' ]]; then
		del_centos_port
	else
		del_ubuntu_port
	fi
fi